Lab 6: AAA Radius Server

Foris Kuang
Period 3/4

Purpose
This lab serves as a medium for an application of authentication, authorization, and
accounting or AAA. By applying AAA to a server and having a server do all of the
backend authentication this allows for enterprises to not have to reconfigure the
router so many times in order to add users and can do it remotely from a computer.
This also serves as way for students to learn how to set up Windows Server 2012 R2
and utilize it as the server which holds all the user login information.

Background Information
Lab Summary
For this lab, my partner and I are going to set up a server with Windows Server 2012
Revision 2, and enable this server as an AAA server. From here, we configure a
router to utilize this server as a means for authenticating people into the router.
Similar to how SSH works except allow authentication to be handled on the back
end with a server doing the workload. Next, we will enable AAA and use RADIUS on
the router as this is how we plan to configure the router to use the server. To set up
the server, we will need it to have domain name services, an active directory
service and a network protocol.

Lab Commands
Commands for Router
Commands
(config)#aaa new-model
(config)#radius-server host [ip address
of server] key [shared key]
(config)#aaa group radius [group name]

(config-sg-radius)#server [ip address of

server]
(config)#aaa authentication login default
group [name of server group]
(config)#line con 0
(config-line)#login authentication default

Purpose
Enables AAA
Specifies the AAA server that is to be
used by the router to authenticate the
users.
Creates a pool of servers that the device
will be allowed to use in order to
authenticate. The group name does not
relate to the server group name. After
entering this one enters configuration
mode for the radius server group.
Tells the IP address of the AAA server
that is listed within the server group
Allows authentication for AAA to become
default and utilize this server to
authenticate all users
Enters configuration mode for console
lines
Causes the router to use authentication

(config)#line vty 0 4
(config-line)#login authentication default

via a connection, in this case AAA

Enters configuration mode for remote
access lines
Causes the router to use authentication
via a connection, in this case AAA

Lab Diagram

Configuring Windows Server 2012 R2

Configurations

Problems
There were a multitude of problems with this lab. For one, finding out how to set up
Windows Server 2012 as an AAA server was problematic as we did not have any
experience setting it up and the video we watched neglected to tell us to add
network access protocols. Next we had the problem of setting up the router and
connecting it to the server but no authentication was working. We saw that the
RADIUS packets were going through in Wireshark, however no accept was working.
It wasn't until we added the remote network feature in the server that we finally got
it to work and started seeing the accept RADIUS packets.

Conclusion